Azure Sql managed instance database mail to external emails blocked due to “Relay Access Denied”

0
votes

We have moved from ono-premise to Azure SQL Managed Instances for our database servers and cannot seem to get database mail to sent to external email addresses however it works correctly for internal (our domain) email addresses. The specific error thrown is as follows:

Message: Cannot send mails to mail server. (Mailbox unavailable. The server response was: 5.7.64 TenantAttribution; Relay Access Denied [PU1APC01FT013.eop-APC01.prod.protection.outlook.com])

We have followed Microsoft guidelines in enabling and configuring database for managed instances in Azure and have used the following resources to assist in troubleshooting:

https://techcommunity.microsoft.com/t5/azure-sql/sending-emails-in-azure-sql-managed-instance/ba-p/386235 https://techcommunity.microsoft.com/t5/azure-sql/troubleshooting-database-mail-issues-in-azure-sql-managed/ba-p/583018

We have named the mail profile correctly as described and set up the mail account correctly as described using basic authentication with a valid Exchange mailbox user over SSL/TLS on port 25. Azure nsg (firewalls) have been configured to allow TCP port 25 etc. etc.

I have looked a the Office365 exchange config as well but am unable to set up a connector as our Azure SQL Managed instances do not have a public IP address but we shouldn't need a connector anyway as we are authenticating when trying to send mail from the SQL Server.

Has anyone had success in getting this to work?

1
sp-send-dbmailazure-sql-managed-instance

1 Answers

0
votes

After lots more research, trial and error and hours on the phone with both the SQL and Exchange MS support teams we have managed to get this working. Essentially we made a change to the SQL DB Mail account to get it working after reading this article here. We achieved this by moving from the connection Option 3 mentioned in the article to connection Option 1. Specifically we used smtp.office365.com on port 25 (as opposed to port 587) and ticked the secure connection box in conjunction with Basic Authentication.